CERT-MU Vulnerability Note VN-2008-9

Microsoft Office OneNote URL Remote Code Execution Vulnerability

Original Issue Date: September 10, 2008

Severity Rating: High

Systems Affected

• Microsoft Office XP Service Pack 3
• Microsoft Office 2003 Service Pack 2
• Microsoft Office 2003 Service Pack 3
• Microsoft Office System 2007
• Microsoft Office System 2007 Service Pack 1
• Microsoft Office OneNote 2007
• Microsoft Office OneNote 2007 Service Pack 1

Overview

A vulnerability has been reported in Microsoft Office OneNote that could be exploited by a remote attacker to disclose potentially sensitive information in the context of logged in user.

Description

OneNote is included as part of office 2007, and provides an easy way to store, manage, and share information.

This vulnerability is caused due to an input validation error in Microsoft Office OneNote while handling URI “onenote://" protocol . This Vulnerability could be exploited by the attacker by creating a specially crafted OneNote URL “onenote://onenotefile” and entice user to open the same. Opening this “onenotefile” URL will executed through the IEUSER.EXE process in the context of logged in user. Successful exploitation of this vulnerability would allow remote attacker to take complete control of the vulnerable system.

Workarounds

• Disable OneNote protocol handler.
• Redirect OneNote protocol handler to the About protocol handler.

For detailed steps and impact of applying these workarounds refer to Microsoft security Bulletin MS08-055

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin MS08-055

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Vendor Information

Microsoft

http://www.microsoft.com/technet/security/bulletin/ms08-055.mspx

CVE-Name

CVE-2008-3007

References

Insomnia Security
http://www.insomniasec.com/advisories/ISVA-080910.1.htm

FrSIRT
http://www.frsirt.com/english/advisories/2008/2523

Secunia
http://secunia.com/advisories/31744/

SecurityFocus
http://www.securityfocus.com/bid/31067